CVE-2025-59452
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-06

Last updated on: 2025-11-26

Assigner: MITRE

Description
The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-06
Last Modified
2025-11-26
Generated
2026-05-07
AI Q&A
2025-10-06
EPSS Evaluated
2026-05-05
NVD
CVE-2025-59452
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
yosmart smart_hub *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-340 The product uses a scheme that generates numbers or identifiers that are more predictable than required.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves the YoSmart YoLink API using an endpoint URL that is constructed from a device's MAC address combined with an MD5 hash of non-secret information, such as a key starting with cf50. This design can potentially expose device information or allow unauthorized access due to predictable or insufficiently protected endpoint URLs.


How can this vulnerability impact me? :

The vulnerability can impact you by allowing an attacker to potentially identify or access devices through predictable API endpoint URLs, leading to partial confidentiality loss. However, it does not affect integrity or availability directly.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart